discordrat | 04eba1e1568a4ad4f54111f362a46b50ae8da9cb81704a051dcfef23d2b04728

Analysis

max time kernel
36s
max time network
16s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:39

Target

Electron.exe
Size

171KB
MD5

3ce82d8a18c09e4c48b4da5de1938c3b
SHA1

406def8e1483d085246b61445979979a747f5851
SHA256

04eba1e1568a4ad4f54111f362a46b50ae8da9cb81704a051dcfef23d2b04728
SHA512

f3097a24bcf2c36580f3a788206a50352797a5e84704bb88411bb3317354d5773eee752ee4890cbcb45a984d568e9168f241d08e56cc33987c40297d4f4f8215
SSDEEP

1536:a2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIuU2MTDVb2cgueZm7Cqg3G5sM:aZv5PDwbjNrmAE+6IMMYdGCjesM

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyODAzODA0Nzg2MjM2MjE4Mg.GqCEYL.apfsS2jQRhuN7G2IWIRfyCOXYhh2VcEiLqIuMo
server_id
1238738925741408256

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2848	2980	Electron.exe	28
PID 2980 wrote to memory of 2848	2980	Electron.exe	28
PID 2980 wrote to memory of 2848	2980	Electron.exe	28

C:\Users\Admin\AppData\Local\Temp\Electron.exe
"C:\Users\Admin\AppData\Local\Temp\Electron.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2980 -s 600
  2⤵
  PID:2848

memory/2980-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x000000013FF40000-0x000000013FF6E000-memory.dmp

Filesize
184KB

Download
memory/2980-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2980-3-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2980-4-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download